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(57)Abstract: 

PROBLEM TO BE SOLVED: To easily deal with an 
arbitrary data system. 

SOLUTION: The monitoring/controller of network 
communication is provided with a data 
collection/transmission processing part V1 1 
transmitting/receiving packets (PT and PTA1) 
to/from a network 3, an analyzer managing part V12 
provided with a hijack function which executes packet 
communication with the data collection/transmission 
processing part V1 1 based on analyzer managing 
information rewritten by a control message CM and 
which individually communicates with communicating 
persons by the packets (PT and PTA2) when injustice 
is detected in communication, a protocol processing 
part V13 reconstituting analysis data DT from the 
packet PTa and transmitting the control message CM 
and data DTA and an application analyzer V21 judging 
whether injustice does not exist in analysis data DT 
which is taken in and transmitting the control 
message CM and data DTA in accordance with the judged result. 
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^t7>fM6 i t A*3«t^ 1 ^^^nmm^6 1 1B ^«i 

J53c^n^o k U>f -V^E^a-— ;i/6 1 k ttx tt^iiSn^ 
•V^^;i/^6 lu^ct^kl/^ ^B«i^gS6 1 W 4 S «J5E 

^LT, &l/-f ^^r^i — ;u6 l , , — , 6 

[0 0 7 1 ] mUaP^SSiS 5 6 2(4, 4l/>ft^a-;i/ 
6 1,, •*', 6 1 k , 6 1 H (C j^V^T7 r -^ ft^fiJo 

tSr-^JS»JWS6 2ai:, *U-f ^^E^j.-;i/ 6 
1,, — , 6 l k , ••*> 6 1„ (C^^T^-^CDfBttft 
»J»1-5^^UWJW»6 2 bk> »W^-^DTftai^ 
^-arSfctoflDT^T-^^ ifgaS5 6 2 c^^«?nT 
l^o ^UT, SijffllgS^S 6 2(4, lKHya- 

;i/6 i , , — , ki/>fn^a-;i/6 i k , Ni/>f 
i7^e^^-;u6 i K ft^n^nsij^st>'^si-^o 

[ 0 0 7 2] ^-^^^5 7(4, J ?»SB^a^T•*5^/^ 

t^-^f^fiESBS e/p^CDlBWy— ^DTJC^iEtf^ 
LT^5*flSl,t»*fe*CD CftttiTj-rs^-^^ 



[ 0 0 7 3 ] ^©^-*8?#f£B5 7fctt. 77U^r— > 

ST'r'J^T — ^3>T^-7-f If 5 7 0 #i9!f* ^ftt^ 
-So f Ut. ZtoTyVtr — >-3 >Ti-v^it'5 7 0 

[ 0 0 7 4] H4tc N 3>7>fyi/-i/3>7rY;i/© 
0!l£5vfo CCDl24{C*5V^Tx 3>7-f^l/-^3>7 
W;i/5 0 0l±, y-^f^fiRgBS B/p&^-^ISSfSBS 
7^^r^-^DT©Ji^^r^feto(Z)tf$g^7 :: -^^ 

w«p 5 7 -eiwsf -rs«**«*atr^ t.w s 4 «t a c 

fcoT#Q, «lx.Kia4tc^-rJ:-5&I*lSSIB*T-§a 

[ 0 0 7 5 ] E5«c x jKfitS^^^AfflfflSgElS (OS 
I ; Open System Interconnection) <D 7 H^E^VUCD^J 

^ 5r A CD M \ f « f g £ 7 o ic PgJl <f b U & t> © T- & D , - 
W 1*801, ^ U >^ W 1^8 0 2, *yh9- 

3>l/-ft8 0 5, 7'Hi>r-y3>l/^t8 0 6, 
?7V*T— *>3 >t"f -V 8 0 7 MPgJf {b^flTV^o 
[0 0 7 6 ] MU^t80 lit rfiiStCi&gfc 

tiTV^So *y ha — 9 l"i -V 8 0 3ttx 

£-«514s ffi £^UTr^©^;*^AP^T-^-^© 

hU-ft8 0 4li, ^£Z)v'^^AC0^T-Mil6tJT-ftiS 

>U-nr8 0 5f£, S^co^r U^r— f>3 >7"n-tr^T- 

>5 L ->'3 >L/^f ^8 0 6tt, flSiS^^^'J^r — >a> 
;/ n -tr X #16 o 7— 9 £ IE St £ ct < § 4 

^>3>l/-f + 8 0 7tt, ^L—^ftmnt^m^uT 

7*)>T — i/b >£/Sl^T, 7 7"f;MEi£x ^^-fe — Sol 

[0077] d©ct^t«dLsnfc*y hv-z^mm 

Sf^rAS 0©lMt&l2 6^H8fcreW*-5. 06 
[ 0 0 7 8 ] jSWfif** h7-^ 3©n^E>M 

aaof-^/^^h, w^Kiie^-^ 9 oa, 90 



ftR 2000-9003 1 

b, 90c, 9 0 d*WlT^££:"rSo 

[0 0 7 9] -n^^iSfS^-^ 9 0 a, 9 0 b, 9 0 

c, 9 0dtt, W*ttia7K:^r«t'5fc:ge$fel D 9 1 
a, 91b, 91c, 91di:, 2&{f 7G I D 9 2 a, 9 
2b, 92c, 9 2d£, IS9 3a, 9 3b, 9 3 
c, 9 3d£:, f-^9 4a, 94b, 9 4c, 94d 

[0 0 8 0] :©3t>;U 5 1 ±^e^?ti^iifl5 =r 
-*9 0ai£, &©<fc5KLT«JK£ftT^5. 
t>> ^'Jxii* H am a cracker, j £.^o77 } ) 3 

(S) 2 1), H amj i;^?^— * 9 4 b r a 
cj ^l^rV^94di:, r rac j ^^of-^9 4 
ats r ker.j 9 4 c tt:»i!l$tifcr- 

^h&6<, f Lt, £6>£*ffl#fbi*ftT (S2 2)\ -\ 
^£ttlt£5iff^-^ 9 0 a, 90b, 90c, 90 
dtdSfu dft^ttEIS {c^-rpgJKb^E^l/S 0 0JCJ; 

h7-*3±7?Or-**tttt> igr-i^gOa, 9 
0b, 9 0c, 9 0d£:&3o COr-*#ffit% 

[0 0 8 1 ] d]6^^f ct-5^ N *y h^-^IESftfr 
y^r'A5 0(t 3 > 7 -f ^ U — >- 3 > 7 r 
iitr (S 1 1 ) o z.tilz X D n ^-^^355 6od 1 U 
-fir^^— ;b6 1 1 1 u-f-^7^;i/^ 6 l U M1 

U^^S«^SP6 1 1B , kl/^+^a-;i/6 1 k 

©ki/n7^M6 i kA »^k \y-c^mmm^6 

l kB , — , Nl^Yi'^E^jL— ;U6 1„ (DNU^f >i )V 
[ 0 0 8 2 ] CICT% NcDfitt{i, 121 5 ^Tfmik^T 

jvs o ovzvmmsx*^-* tLTmnm^zfr^ 

ctDifeS*ns 0 *SlflHBJ8T-a:. N=7i:U77 e, J 

U N=7tcPB&n^ WI*ttN= 3 i:UT*^h 9- 
^/i-fe ^ a >*{StC * T-SfllS-r 5 "5 C3 T ? 5 o 

[0 0 8 3 ] ifct, ^*-^i|X»^5 5HU ^-^1R»$IJ 
M5 5 2©»I»TIC, 3^e>/^ 5 1 (D±ZBm$ti 
-C^hrttry hPT© 1 M>r^ h (M^tt'ilfgT-*-^ 9 
0 a) ^m^ii^ (SI 2) , 3(7D 1 >\>Ty \f 

-rrssfisptfeaf^at^uT'tint:— ?ti* (si 

3) o d;fU:«t!K CtOf^Slx. U r £ 3 t-snfc 1 ^ 
iryhB, PfJlib^e^i— ;i/5 6 icd l UY-V'^E^i — 



(9) 
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<{ ^"E^zL — MzMir (S 1 4) o Z.<D 1 Uj^^i/J- 
-;b6 1|t'lt *>TV h<D^yy$$<D££g£tey J 

[0 0 8 4] &^T% 1 l/^-^^E^J-— ;W6 1 , ©TJ1 

So 

[0 0 8 5] k U-f t^^i-^S 1 k (Dm<D : Ei?3.— 
[0 0 8 6] CCT% S-U-f i'^E^i — ;i/6 1 , , — , 

6i kJ ••*, 6 i B T-&mm<DW i m&mfi£tiz><DT^ 

[0 0 8 7] k Wi^^a—;u6 l k S\ '^toSS^ii 

£ft£=?>:7>f tru — z/a >7 7>( )\s<Dffimi£fobXs 
gttlfco tzT — Z $:kl/^t7^ 6 1 | A tcii-T©*» 

t% ^cDK^^eeoTMLasiifT'rs (s 

15). 

[0 0 8 8] ^Jiil 3>7^1/-'>3>77>f;KD 
l kA £iIjl£-e-fcCD*> (S151 ; YES) , -e©^— 

^sswas-raa^tt (s i s 2 ; ye s) , 

rfcffifflbTWBSSb (S 1 5 3) . 77'J^>3> 

(S154 ;N0) , kl/>f -\^>? jl— ;u 6 l k 
So f bts )k<D'*lry hS^iitf (S 1 2) o 

[0 0 8 9] A*^77^ffllTSilU (S 1 

5 3) , H«aS^TUfe»^ (S 1 5 4 ; YES) tc 

^ (S 1 5 2 ; NO) £tt, WWaSUfe^-^S^-* 
JBSrSBS lizm-ft^ ytttofcfcgic (SI 5 
5 ; YES) , kU-Y-VSfil^SP6 1 ks CDM ^ 7 r tcS 
;LTOfc^-*fe^-*JI?»8B5 7 t«f (S 1 5 
6) o t^-^IWWSSS 7lcjtS3&t^>f 5>^ic 

^of;h:?,t' (S 1 5 5 ; NO) . Ctlcfc 5 ±$JGDJf 

[0090] :tiia^ i k i 



-r«fc5CB«3S*ftT (S2 3) , ^f!l*nfc^»-^ t 
UT frac j fct^T*-* 9 4 a#r-*»ffS5 7 «c 

[0 0 9 1 ] J£l±CD#ia£ bSC3Hi5iI-rc i: 

(S2 3) , H amj fc^-S^--* 9 4 bfc. r a cj 
hl^r-^ 9 4di:, r racj ^l^T-^9 4a 
fc, r ker.j * 9 4 c ^ iafc^— * 

£ B«^^nt (S 2 4) , ri ^ a c 
racker. j hl^77'J^r-y3 > b -\ 7 T-<7)7t;<Z)5 :r -- 
^ 9 5£2;ft,&o 

[0 0 9 2 ] T(ft©ii©U-f -V^E^i— ;i/4 s ±IB©<t-5 

[0 0 9 3] Nl/^ft7>fH6 1,m ±itfc|5ltlS 
-^DTh LT^-*8¥#fSfS5 7tCffi-T (S 1 6) . 

[0 0 9 4] C©:7D— >£te/amK. 

CD £ ^ y * > © ^ IE T $ -tr ^ & |e] B$ tc E*l T & 5 o 
[ 0 0 9 5 ] t*— *JW«SB5 7t-lt 7:/'; >r-5/ a > 
7^^>f If 5 7 0 #^§c^iM,T-;fc0 7i=3 >7 #\s 

ITl^o C©77 ,| J^r->'3>7t7^tf5 7 0Ofl 

9 0 0 h LT^^^ti^o 
[0 0 9 6 ] ::t% 77'J(r->3 l^T±^^ If 5 7 

[0 0 9 7 ] (i) iilLTi^/Ph^^TMJ;^ 
^Jii&yrU^r-va >T7"^Y1f 5 7 0 7 >r 

^ =3 > 7 >f ^ \y - > 3 > 7 7 <i MzmmZ tl fz Jt 

[ 0 0 9 8] (ii) -tr^r^ 'Jr-f Sfit^l" 6fc»tJKS 
t:fltl)^^i.77^1/ J p7D^7A¥$:77 ,, J 
^r — +f 5 7 0ffl©=3>7^ — f>3 > 

[ 0 0 9 9] ±iiHbfc^^ h^-^^ZE^Wv-^^A 5 
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WlhTSa. 

[0100] (1) TCP7Dh3;t/©'>-^>^Sf 
£Jf$JU «©**5/3>£l»«Lft*#ft** h<D7 
7 -Y MZ ^TET # -fe* f a C £ o 

[0101] (2) SMTP7Dh3;i/©DEBUG3 

-tr^-Tacko 
[0 10 2] (3) MIMESffioTJifc**;* hCQ-tr* 

[0 10 3] (4) 

*h®fflSfE**S*T;*:*fciSDott, 
[0 10 4] (5) telnet^D ha;UT% root, guests 

»S u^r^v YVLTZ-tTs 7— H Sialic 

[0 10 5] (6) TFTP^D hn;i/$:ffll^Ts ^^y — 

ko 

[0 10 6] W±©Ad^«JBK*nfc*iaKJBffiCD*y 
^6 So 

[0 10 7] (1) rr'^-v'a^TOt^ya 

>r — ^3 >J1S T-CDH* y *>3 ><DBfll^£fToT^a© 

L*p£k *v hV — ^T-C^IE^fKtt^— 
*gB#£$8£-ra<Z>T-, *ffl#©^IE£t#ai"f 
3 - kM «fc 19 J»*©fil^iEj|IW&fT^ - § So 

[0108] (2) JiS^^&^ji-Mbtcj; 

;u8 0 O^ct^^^e^MbT^, *HJEJB!ScD*y h9 

— ^IEfc?#f V^^A 5 0 i±=3 >7 ^ ^l/-i>3>77 

HfT-rscDTv Srfc&7D h^ji/W^nt^j, =3 > 
a -;b<2^ £ 4 C h K J: 0 »JS-r 4 - k *st- * 

[0109] (3) ^-^»WSPTO^IEISPW«±=i>7 



-y3>77^ ;i/©iaai*^Mi"a©*T-7 ? — ^sptifgB 
©V7 h ^^gf*£^sirack&<f&&ira;:k# 

TSSo 

[0110] ( 4 ) yh9->3 fctfDfi*^*? 

#t«tt), ffiB©iI«6«9»*acfc3fcfcofc. CT* 
tt, LAN 1 ©y^ — 5^3 >^ffl^*y h9-* 7 
»fe4»-&{c, ffi*Oi36e7ci:gB$fefct-3V^TTiE» 

[0 111] (5) ffl«W*v b9-^/3kLT*X h 
LT^a<£>T% h&<D^iQ£&§glC#/S 

T§So 

[0112] &±<D£oiz*§&womi(Dnmmmiz 

[0113] 2 GDSHECDBffi} H10t, #*fB£ 

•To CfiDH 1 OtciJ^T. *y h7- ^^JEmm^^y^ 
A5 0tt, ^WlfjOSSIKtfifBttKBtijattStLfc 

y ^ a s«is-r a c k iz x o ti a * cdt- fe 
t, ««a(&^^-^3>oiaT-ie*fb*nfcrD h=3 
;u tc X 0 »e Sff a «t a «c * ii & * y h 7 - t * 
fta^iESrWWi-a^^^AT-feao 010^ 

r$iJSM y-fe — i^cDSittij * -eft-eft^ LTt^ a (13 

OM0 3 4-13 7T*IrI«) o 

[0 1 1 4] 1-&t>%, *f N l 7-^/^IES¥1ff>'^^A 

5 0it ^JR«/i£««tSfflV 1 1 T + ^'df 

^m^V12L, 7Dh3;i/ffliaJV13i: N 

— >r^-^-T If V 2 1 k, 7Dh3;^^7^Vl 

0 1 k, *y F7-^77 , 'J^r-y3>V2 0 1 k£>e> 

«j«£ixT^a. ^-^iRM/^ft^iiaJv 1 

lk. r^-"7>f -tfgSSBV 1 2 k, 7DF3jH(!lISV 
13k, 7Dh3;M^7^V10 1i:{t OS^V 

1 ^Ci5^/^TjlS^i^TV^ao *fc, T7 , U>5r->'3>T 

ifv 2 l k, * y h v—#77' l )>r—isB>y 2 
0 1k(i, J.-ifffifflV2{cSIK*nTir^a. 
[0 115] Sfc, ^-^iK^/^ffMS^V 1 H±. 

P T$:gx!9iitfiK»®Ji^lltTL, & a Oii7t7 >T if 
*gH95Vl 2iPh<DWy hPTA2SSjfJLT^^ 
hPTAl Sf^fiEUT*^ a^-^lK 

*/^fixii^^fT^a 0 ^-^jR*/aeffl.s«v 1 
a Q 

[oii6] 7^^>f ifsaav i 2tt, y-^iRft/ 

^fl^IiaiV 1 1 frt><DJ*>?v hPTfCOl^T&T'^U 

^3>^^7-f-tfftt«c7-f yu^ffljS-^^^y— KSQ. 

35 V 1 3^6C0igfg7 :r -^DTA^^LTPTA2S: 



^ 5 if tixg ft ntf -r 6 o 

[0117] 7D h^WBSfflSV 1 3t±, 
II9SV 1 2frt>(D/^v hPTaftZ^'J'y' — >-3>>? 

ft *- § c 4: t ct 5 * D T ftfftefc-r 

r^l/ffiaxgft^TU 77'J^-ya>7t7 

[0 118] itl&^^-f IfifSSBV 1 h 
n^fflSgBV 1 3tt£ 1 CDUfflffJffiT-©^— ^f^fiKfflS 

;HQ.axgtt^ 1 cDHSSff^T-^^-^^xflicts^ 

[0 119] r^'J^-ygVTt?^ tfV2 1 tt, r 

£ LT ^ £ UT IHIfflS* CDC ft!±l^j U i fc8¥tJf 

IS** 6f-^DT AX WPJSM «;t-^CM ftf^JEK-T 
^^-^MWXflft^fTf^o 

>f ifV2 lSV^— i^»«fxflttx ^fl^ftg! 1 ©IHJS 
[0 12 0] 7p h3W>y*V 1 0 1 HU ^"-^iK 

■^oa-r « - fct j: ^w^-^ d t b ftf^ja-r s ^ft 

IZ S *y F7-^77'J^r-y3>V 2 0 1 A^iStB^ 
— ^DTBftSltffioTfflSUTj^Ui^y hPTBft 

f^dtisaixgftsifT-ra. 

[0121]*y h7-^77 ,, J^-y3>V2 0 1 
7DhaiM^7^V10 1^^Sffr-^DT 

b ft^ 5 a*ms<&ffl3£^fT ltsi±it-^ ftf&ss-r 

[0 12 2] dCDJ;?*:** h 7 — ^lE^tfrv'^A 
5 0(t Ell OJC^-TctatCx If©^7h9-^77 

iigt, T:f5>f ifgSxfli:, t'd h=3;i/U[iJixfI 
t, 7^-7Y1fxSi:ft^fft-5 4:Jtt, 7*-*ffr5RiS 

tBxss^*^ h^— ^fflfSxaftUff-rso c©^^ 

[0 1 2 3] 01 lMHl 2tc, ±83** h 

v^t, nafcjR&fcffltt r^-^oattu ft, »et* 
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[0124] c:ne>©iaK:*5c^T, ^^tressv 

12tt, ^-#i${S#t3£i5V 1 2 at ;* y-fe — 
SUV12bi:, 7>f ;u^^aa5V 1 2 c t 7^-7— K 

mm&vi 2dt, trsa««v 1 2 e fc*e> 

ft*. 7^7>ftfSa««Vl 2efcH\ 77'J 

^->-3>T^-5^if AfflCD^atfffSV 1 2ea, 77U 
^->-3>Z^^>f IfBfflt^gaWffiV 1 2eb, JkllT 

7v>r-i'a>7i-5K{'*f cm<D<gmmmv l 2ecftf/l 
[0125] ±gB7 r -^ase«ta»v nait m« 

^-^itK^/^ff^S^V 1 l^?)©^7bPT« 

ftffoo ;* ^-fe — ^JDfSSBV 1 2 b(±, y^JUpflimffl 
V 1 2 cA^©/^ v hPTft^vii^&r^U^-iy 

SSt»?BV 1 2 e 7>f ;i/*#L3S5V 1 2 cXtf:?;* 
■7— HilLSgBV 1 2 d4^#flB?ili*:^ — ^«L3 

V12btt, rPh^iUjKliSVl 3*>6>©r-^DT 
AftK5&^£fc$'JSM y-fe-^CMft^Dii^T^ 
-f ifSatiMRV 1 2 eftM£rlT£o *2ie«l3IfflV 
12att, 7^-7— FJ&ggBa**,©^* b P T f Xtf 

fttTlv^^y hPTA2ftHJ*-rSc T^-^-fif 
m^tf$gV12e(i. Mi(i77 , J^-y3>7t7'f 
If A (V2 1 a) fflcD^attfgV 1 2 e afiV77«J^ 
-ya>7t7-ffB (V 2 1 b) fflfiDflfltftVl 2 
ebM77 , 'J^r-y3y7t7^1fC (V 2 1 c) ffl 
CDgStiilRV 1 2 e c h^^^J5£^nT^^,o 
[0126] /Dh 3;i/#L3ia5V 1 3 BU 
S^E^jL— ;uv 1 3 a i: x h afrHHMti'*— )V V 
1 3 c 1 7o f □Jl/JKII^ ^a-;bV 1 3 c 2 

[0127] 7°n ;i/V 1 3 att, f^J 

77'J^r-y3 >^-5>f1f (A) V2 1 a {C <t 

hn^i/MS^E^i— ;i/V 1 3 c 2 tt, 77^ 
-S/3>7'^7-Y1f (C) V2 1 ctc^oTllfS^ti 
§ 0 T^ru^r — ^3>^^-7>r If (B) V 2 1 b 

[0 12 8] yyi)sr->>B>7i-^4+?v 2 lii, f^j 

T^^U^r-^BV^^-Ylf (A) V21aL 
77'J^r-y3>7t7'ftf (B) V2 1 b 7/'J 

>->3>7^-^-fif (c) v2 1 cfcfre>«jat*ixT 
■ra. 

[ 0 1 2 9 ] El 1 3 T't-^-T If^Jltf ffiflO^Jft^ 
STKt 7-r ;i/^®iia5V 1 2 cA»f) 7D 



S5V1 3C8t^v ^PTa<7)Ji££1-£fc#CDtS£K 
^ 7*7-HffiSSV 1 2d*6>5 s -*««ffl$V 1 2 

[0 13 0] CfiDJ:-5fc*ric3Fix&*y hU-^^JEM 
tiri/XTlx 5 O<£>iSfE£0 1 4-0 1 7 £#HSLTI£W 
■T^o 0 1 4ME 1-5K, [slfx^^A 5 0 £##5* 
y h7 — ^ 4*e>6D/^y NSrfil31-j-5»^©l&f^Sgft 

fA5 0 i: tit § 77 'J ^r-y 3 > 7 1 7 ^ tf V 2 1 A» 

— ^-y — h &St 0 il7ic, 014 -El 1 6 
^-^iSfsSSVl 2 a©lWmBJ31r£fctf>^E>7D-57 : - 
[0 1 3 1] HI 5Cft«fc?C h7 
— ^^iEISPW^^^AS 0t±, hSKDiitr (P 

1 2c£;fc^t\ *ffiS©T^-^>f ■»fA s #ffi-r5ig'&tt 

(p i i ; Ye s) , &9m<DT-r^ j vrnm.^mm-t 
& (p 12) o *«ia©7^-^-rif* s ^ffiu&ir i >S'&tt 

(P 1 1 ; No) N 7*7 — FJQ3ISBV 1 2 d^S>ry 

(P 1 3 ; Ye s) , /^^h^7P h 3 ;Mffl3iawj& 
ffi-TS. Sl&£«e^»^tt (P 1 3 ; No) , )k<DT± 

^ >r +f £ *t ~r z> m m £ ^ £ • 
[0132] 7D huimm^v i 3«\ y^cju^mm 

WT-^JBSD^^hfeJQflU (P2 1) % 5^- 

*&7^>f if^teas-*-* (p 2 2) o 
[0133] 7*7- Kamssv 1 2d a, y^jv^m 
iasv i 2 c*f,sitaofe^y ^C7^T^ 

oa±SytfSStS*B^ (P 3 1 ;Yes) , Jkmmco 
StltflUSSMf-TS (P3 2) o *fflf3lCD»±flUtf??aEO 
fc^W&ti: (P 3 1 ; No) , )\>r y hft^— 
1135 V 1 2 a^igi. **S0>gtitJW &Bfc» 

^(P33;Yes)lt (P 3 4) , 

16(P33;No) 14, *©*ffla©»±IiJtf?lFaE-r 

sa^s^So fits ±r©s±flUt^iS[U&^»^' 
[0 1 3 4] mi 6£jf*l-cfc7£, ^^-b-^jaagBV 

i2tt, Tj-^jy&mmistz* vt-^ssits 

(P2) o 5«Ofc*y*-^0W8£^Ufc« (P 

4i) , T'^-^YifBawwtsEtffeofca^tt (p 

4 2 ; Yes) , 7^7^«3««©£Effiffl*fT3 
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(P 4 3) o ««3£M#&*o&»-& (P 4 2 ; N 
o) , Stlt 7^"5>f-tfS31««©SKMft^TLfc» 
^ (P 4 2 ; Y e s ) . &fc^-*i£e#!&g&»^ 

(P4 4 ; Yes) , ^-^ £?-^i£{§ V 1 2 

a^ae-r. ^-*»<s a^g^a^a (p 4 4 ; n 

o) x L&^ 0 

[0135] 017lt 014-016 KttiltCSinS 

sw-wo (P5i) N aeRiffifcatSctotc^— ^s«e 

ffJU (P 5 2) , j|Ult*y h9-^^f^Sil) 
(P 5 3) o 

• [0136] St, ^07D-f + -hS«ffltiitf. 

[0 13 7] B18t, ±iELfc*y h7-^IEjW*f 
:>X^A 5 0 £®fflL£3Iff^MMCNC£. 

— ^NTwr-jgJK$nfeafi3SBMCNA, mcnbc 
[0138] ±m^frmmmmzmz-fzmmmsMc 

tf>f >*7i— ^&a«-r5c:i:As T .§ So c 

m&V 1 2&V7ah^JU9Hm&V 1 3. ££&0 3 4 
fc^-TUr^-^-f tfSSSPV 3 1MU7D h3;i/#L3I 
35V3 2, $ § uiii 3 6 t: ^ t 7d h 3 ^ 7 ^ * 
V4 1 SrSt^-T^o 

[0 1 3 9] 0 2 2£, UNIX<£>7^ h^-f »J CD» 

[0 14 0] IsJia (a) te7rs-f #$gB§©ii{t-5» 
socketOBSacDDft^tBUJCt 0, 77'J 
3 >7-^^^f If (4CA7*D h^;^^^^h)gSt 

[0 1 4 1 ] fit, bind()li8«C0Dft^tBU«Ccfc *9> 7 

accept()^gi((4, 7 -f )l>f o -fe y >- 3 

BBJSSnSi:, acceptOHJSCDDfUftBL/^^MDx Mite 
^t^S'J?new_fd $rf#^ 0 CCDnew.fdSrffioT-fe a 

[0 14 2] t^ZfiK new_fd^f£l^^-tr-/i>3 >CD 
WWSfT-Siix Sf&*:7-f ;i/^;i/-;i/{c-&-5-tr ^^3 > 

-tnASforkO^^i/T-feS. forkOtc J: 5 7*D-ir^ii*g 



a > U T SfittBtfaccepU ) £ u 7 >r ;i/ 

-te ^ ^> a > £f#-3o 
[0 14 3] BI2 2 (b) t^-r«e*OiHs5>f 

socket()M&©t#U^UCck^ *yh"7 
— $77^ >T— >3 >ii7D,h3;i/^^ y ^ iigf^t" 
-So fit, bind()«»Oi*vmuC«t5-y---tf^feffi 
^1"5o acceptOBIft&^tllUT, ^7^7 

$> 5 i: accept () H8«(3DD?VUi e>R t) . if fc^iSS'J? 
new_fd£f# So C <£>new_f d£ {£ oT^7^ r > h hilif 

[0 14 4] new_fd Srffi^^^^-f^> 

iifsttS r J©^D-fe^TfT-5^fct«t5o ^cCDtzfo, fork 
()*ffi-5- forkOJCtoru-fe^ttSSii^JcgrJixSo ^ 
fork()©MOfiIttOT-&£o ^©a-&ttOT-H:«c 
^ 0 ^ttnewjedfeteoT^^-f 7*> h hilff U M 
ttff^acceptOSn— ;i/^;i/— -5 -tz ^ ^ 

[0145] ±iE©ct-5lc:«e3fe©*^ h *7 — ^ #Wfy — 

[0146] El 2 3 fc:UNIX©V£ry h ^ -Y ^ U 

[0 14 7] |5j|2tc5vr<fc-5^ hijackOSStODfl^ttS 
U£ <fc ^ W ^i* ^ jR!B iz&ft-t 5 • - ©tWKT- tine 
w_f d £ {£ ^ ^ - * £ i£ (gf S - i: * $ T- S 5 ( w r i t e ( ) n - 

^ii^*«lreLTfTX.5. write()n-;u©§|§iR«Ci36 
[0 14 8] S6*B:M>f ^^y^«tEOHao&»«Ci(5 

[0 14 9] ±iEbfc*y h7-^^IE^Wv 

2 4-12 6 ^zTnI-o 

[ 0 1 5 0 ] m 2 4RUm 2 5 iZTjkt 
ETHER:00:808:17:88:8d » 00:a0:24:23: 16:0d 
IP:202.26.75.116 » 202.26.75.71 
TCP: 40508 » 23 



mm 2000-90031 

(DfflfrltfrX hk (\?T KL/^{±202.26.75.116) 

^ hB (l?T Kl/>Ui202.26.75.71) ^ telnet (it— 

t^*- hS^2 3) TMSiKUfeCtSSflfc-rs. - 

$)§ a SRCfsource^^fcSftS*©* 5 ** M 

DST (destination) X&t>2tl& t><DlfiftX r-BT* 
S o 

[0 15 1] [ src « (DST) ]<D&ftl£, DSTA^SRC^ 
f-^«ot?tCi:&SP*tl)o SRC*e>DST'x(Z>7 ? 
-*tt[ (SRC) » dst ]£m&o flt^ (id:4553)i£ 
ClCDiiffcDlSS'J^ <len:71>B\ ?££ftT§£^ 

"To 

[0 15 2] dfttCEIB:. *v b r J — £<DT—#%Wt 

tCtelnetT-jg^U r-B# 

BSDI BSD/OS 3.0 (netlog.nal.go. jp)(ttyp0) 

login: 

^T^^hAicig^o hAA*P>rot i: -5 A** s fe 5 , 

*X hA^&rootlfcV^A** 5 ^ hB«±l 
ogin incorrect LT 
[0 15 3] EI2 6c^^7T^P t DSCCOV^TIftB^^ 

feSo Ethernets K U^IPT H UJ* , TCP*— hS^ 
£A*T?t5 7>f — ;i/K* s feSo PlBI©«IT*tt. IPT K 
U^202.26.75.71©25#*— h ^©iiff ~t^X Zfflffitt 

(±, 202 . 26 . 775 . 1 16 A» & 202 . 26 . 75 . 71 T © "b v> a > 

So 

[0154] Sfe, -cd^Y > K^^DcDSffly^^^ 

AT'^/n£*XT^£o gTSB^2^)(Z)*^>A s fe5, 
[Kill Session]*^ >tt-t? v is 3 >©^SiJJ$T&frV^ 
[Hijack Session] fi-fe ^ ^ 3 >^7D>'^-r ^-v »v^Sfr-5« 
C(Z)[Hijack Session]*^ > £ff Lfeftii, -t©*^ > 
<D±<DCmA to Src-^Crad to Dst 7 -f — ;i/ K tc^*— ^ & A 

[0 15 5] C»3CD^«SCD^SBD H2 7t, [b|* 3 © 
^S:HSttTv;i/^*-A^b-rS-h^-e#So Wlitf 2 



— Aft LTS'JfSCD^^ h^ — ^ 4, 5£*g$c£ft3£:t 
tt, LAN 1 h^ptf^ y h 7 — 4? 7 t.<D?$(DM.{E&i&'V 

OW^^ b©iKJR£3xD -fSl>»Kff 

[0 15 6] 0 2 8H^T ct-Jfcx ^b? — 4? 

^lEf&tffv-^xA 5 0 2x1bTZ>t.g;lZ, =r 

— H^y^StfS cfc-5 £ ITfeM^o «t*3\ 02 8T* 
tt, 5=^— ^f^JBdtSB 5 6XVt*— *8¥ftrSB5 7©ft#:fl<J& 
0t^&^I9§LT^6o C?)£§1^ ^— ^#PUfSB5 7®» 

f±*y hy-^^IE^Wv-^^AS OrtSriliiS-fr'&V^ 
tfot, *y h7-*t*O^IEOLANl^©ftASK 
[0 15 7] 0 2 9C5vr«fc-5£ x "r — ZWWL 

i kA , 6 i (A &*-r«»7-f u v^jaasBs 8 

fc, Ji«ifi©U>f ^S*SSSS6 1 ib, -> 6 l kB , 

6 i n *^^-z>mmmm i m%v>b 9 fctoBrAfc*©K:-rs 

ft. h^-^IEMWv'Xx-A 5 0 <Di&^©rai$fb 

[0 15 8] ttzs ±ifiUfciB l©Sia«B!BStF*3(0 
»ST'i^^ hy-^^FIE^Iff^^^A 5 O&0^ 
b^^nv fjL— **>;*^A;&»£*JG!££ft4 *><£>i: bt 
i^Stf, ilftfcfcfclE^ftfc^o tf'Ufc^ ±i£Lfc*yb 

£ r - $ ffi tfr X f 1 fc £ =J > b* a - * lc H f f * § fc to © 
[0 15 9] :iT'OT'Py7Alt RttttKtiU Wffl 

assfT"5«tac**snfc*^ h?-*±-eeiat£ft 

— ^JKft^HIh, PSJlfb<¥ftfc:/o h=3;i/Jc/oi:3fcfSJi 
<b ^ j. — * ^ ^—-9 £ ¥ #>ss^a^ t? ^^fc^ > 



&KI2 000-90031 

»; >^ut^^^ b^^fb^ftfe^ 

65£a)*ffiC|}«S5-r * d 4: C <t 5 Srffc 

^ * ft f*j sp * * t ^- * ftJ5K*je* e> ©ww^- * t 

[0 16 0] Sfc, ±aiU&mifiJBJB-rt±7 £ -*iRiSx 

ii, cn^^-^iR*x|lh^-^#j5£xflh^-^S? 
WXfIhS:=i>t:i-^tC||fT^-y:T^a^\ Ctltli 

pg e> n-rd n e> oxgs ^ >^ n^&^^ff ^ a <t 

t^T7-*-^iR»x|I^?>©y^^ b SS-KJlfb^^i — 
;i/t-7>f U >^Lty^-v h<z>*ffl^b$ftfc7*— * 
S7C©#ffit f}*SSt* 5 C ^ C <fc 5 ^ s^fiRt" 

[0 16 1] C*4©|QlS©JgffiD 0 3 0«C, |5]^4© 

^ss^ff^^^-To do03 o tc^-raft ^^^A{i, 

ffift^V 1 1 t N h7- 47 4 fcffetO^y 

g^V 1 1 h^F^T-aff * U h9-^ 5 ii^-^iK 

m/mm&m^v 1 1 ^^p^T-aff j^tc^r 

[0 16 2] CCO0 3 0 C^fyXrAT'tt, aft 
MCNAhlll^fMCNB i:©PJ<Z>ffiff tti^T* *y b 
9-^^ZE^W^^^A 5 0 £fig;Lfca{i£IBMCN C 
*aa-rSdi:«c*:5o WI^K, 03 1 (c^io^ 
fflff3SffiMCNA*e>afll*lS[Hello B!], affti^^ 
[A->B]St5/^^ h* s 36-aiSnT< Si:, Mfl^SM C 
NCit *<D/itry h^CA^D D 
ii^, C Aa@7>f 75 'J S^UT7t7>f tftaiBrt 
$[Hello B!]*e*S. dCT% TIEtf&^a^fcltt, 
|g— l*|g[Hello B!]tca(sffl^*[A->B]3&:5y^^ h S: 
afl^SM C N B tz&min a 

[0 16 3] afgt^IEASifeSfc^JBf t 

H3 2C^t<tot, a®jS«MCNA3&»&a« 



f*)MHi B!] , afEffl##[A->B]fc5^4r* hWUkbti 
T£X, ttzs afS«BMCNB4>e>a«rtS[Hello A 
!L fiffffl^[B->A])&Sy^y htfiJifcivtS&i:?- 

[0 16 4] 113 3 <fc-5 ^ tffct^iT- 

c^aff fW-s^t, aesBMCNAcase-r-^ 
3ifi^^[oh a! ] tmm iiM c n b tc&ft-r^ t aft 

|*|£[Bye BU&fEfiR-r*. Ch6ft8S7t7 

***HU affrt§[0h A!]t±aeffl**[B->A]S/*jD 
LT&itiU afi^S5:[Bye B!]ttS(sffl^[A->B]S 

[0 16 5] COD J: ate LT^£<£>T% ii{if*J^£:S£5*l 
[0 16 6] -CT% Ell 9J5WEI2 0£. C©^5Ecd 

[0 16 7] £ CD 121 9 (a) C&^T, a{f^*#T 
CNA, TCNBi:©Flt:^^ h7-^SISPiiNWC 
Ttf^ffiUT^Safl^^Afcfc^T* hy — ^ 
SiJiSiNTCTt:77 ,, J^-'>3>77-7>ftfV2 1 

^n-5o Z.(D£§, ^^b7-^SM!NWCTi:§' 

tC^-TctdK:, a Wttf S T S a ^ ?> r - ^ iRIttl S 

[0 16 8] -f £^ IfgafflV 1 2B\ El 1 

9 (b) IZ^TXo^. ^^h7-^W^lNTCT 
Sr^LTaff S**T CNA, T C N B<Dt"—$ 
-TSd-fctft*. *yh7-^91»fiINWCTtt, El 

[0169] 7^5>f ifgSgBV 1 2#ilfg£ 

14, 02 0 (a) t:^*r«t-5^*y h9-^«JWSS«N 
WCTS*jgf$ijfflib-rtei3|ft , BrJc-rs. d<Z)i:§, * * 
hy-^$'Jffll^SNT CTIt 0 2 1 ic^Tcta^, ^ 
-*JK£tt!BS T S ifl/P6teiS*Bftt!BS T S y iz&fs 

[0 17 0] *y h9-^»JSP^HNTCTtt, 

ffit-itffl, ^lEff&ttftK, <B26<fBftt«STSr* 4 

j^AHU SV, Ell 9 (b) ODttStc^ff -TZo 
[0171] h7-^SiJaW^SNTCT 

±JEUfc#i£T-»«U ^IE#fc5fc*»J«rLfcfc&fc: 
^fTS-^So C©*SJH, E12 0 (b) a 



2000-9003 1 

LT7 ? ^u^-^3>r^-^^tfv2 i tmm U * 

fc* If3»tTCNB(J7t7'f -tfsaspv 1 2 ta 

SU r aiI^*^TCNBIH]±ttS^©aff $:fTotO S 

[0 17 2] T^^tfgSSSV 1 2*^— ^JR 

T-fe5k ! PJIBfbfc*©t:ol>Ttt, E]2 1 izynirjio 

f - ^ iKIttl S T S /? ^ a ^ ^ ^ 7 ^ tti S T 
S tf £H%tci|£fT£-es« -n^ J: aff^*#TC 
NA, TCNBtt, El 1 9 (b) CD#^2)>£>E]2 0 

(b) ©tt«fc#fT-r5^i:£«e5. 

[0 17 3] :©i^, aff^*#TCNA. TCN 

BcDaft *7^-^>f ifea»v 1 amt 

[0174] ftat^i:^ ;r©J;-5&*y hV — Z^IE 
SPW'>^^A 5 0 &«J5K"T5 ; &SK«c«t 5x Iflrt§^ 

fcaft <zvw >^ ^ -5 ^ai-^^-^-r -tfgggpv 

^T-CD^FIECDLAN 1 ^CDgA*B6lt-r 5 C 4:* S T- § 

o 

[0 17 5] fc*>\ ±ifi(3DllMHI5!BH:*«W©»iaft^ 

[0 17 6] tHitf. *v h7-^ 3tgER*nfc* * 
h 7 — ^lE^flfv-^^A 5 OtCO^Ttt. El 3 

liasv 3 2 * ji— trffira v 2 tsssrr s ct a £ t* <& 

V 1 0 1 fcm>TBu El 1 0©^jE3cih[5]# 

[0 17 7] *yh7-^4,.5t8eSiXfcr 
a7M-AftLf^7 h^-^^IE^W^^^AS 0 
ic^>^T(4, EI3 SJC^-TioJCx UT^^-rifgliSi5 
V 3 1 tUT'a hn;vS[lS^V 3 2 If^Pav 2 "C 

tt, H3 0©«J58i:PI«tcOSffiBBVlt:SISbT*5< 
[0 17 8] &£^t£, El 3 4M13 S^HJffiffJffi" 
^V10 ncoi>T^J--+f^F^V2T-^-r^ctdtC 



[0 17 9] *y h?-? 3£SE«3*lfc** h 

9 — ^IE#?#r>>^A 5 OtC-^T, 03 6CC^"fct 

[0 18 0] *vh7-^4, 5t»«* 

nfe^^h9-^^iE)Kfr>^rA5 0i:o^T, B3 

***V4 l*OSffiPavit:§l«-rsci:K:J:D, H 

[0 18 2] ±^U&SB2©|£6fiJBffifirf*4(0 

^-■7>f if^BSxgfc, 7p b^M&Jlxg^ T±"y^i 
if x g i: £ a > t: — * £ ggfr $ -tf 5 & to © 7 p ^ ^ A 
6!BSUfeCD-ROM^7D«)/t-T-f^i'*©3> 
t: a. - * SS<fc3i 5 qlfi §B»«Ef**ffiffl L T iFLffl n > t: 

[0 18 3] ;^T'OrP^7A(l WfcftfcBu 

^ ^ ^- ^ >f if B3S«« mm/mmmm xg 

e> f# tz s if * b * & ft? w^ - * £ s*g ^ 

fiCfi2t57D br^l/ffiH^JBi:, 7P b^MQS 

So 

[0 18 4] ±a*©*Xgfc;&n£T^— ^ffJffi 

EllHxgi:** h7-^iHfl*^2 >f3.-^Ci 

ffi 5 rJ ft£ fe 8BfflkJ«# & ffi m U T iUffl =i > ti* a - * £ ^ 



ftffl 2000-90031 
t><Drt>r v b ^mii^F/fS^MfSS: bT ISMiff t*— * i: 

- * f^ffiiS tB 8?#t 7 s - * £ S It «l 9 F/f ^^ffli 

[0 18 5] *fc, ±JEUfc*^«0K«T-i±7 ? -^«* 
/ElfifflSxgi;, IfCaxgi:. :/a b 

fflJlxgfc, Tf-^-f ifxg^cD&xg, &s^«±^n 

n-f c ti e> ©xll s Hffl © =3 > f 3- - 9 J5E SffiS: L 
feUJEJFJffi-r-tt, cix?>©xg$:=i>^^-^^^T^ 

[0 1 8 6] 

[0 18 7] Sfc. W*«3IB«©*y h7-^Ig© 

Jg felSStc [pj± S -ti S C ^ # S o 
[0 18 8] Lfetfo^ *«0^©*y h7- CO 

So 

( 1 ) ^"^U — r--f X/v-^^ACD^d ^ ^ 

tS^BSff^^-v-H >fSCOSff 5:»tffT^, ffiffi^^- 
^^h7-^±©fl7>fb?JltT»^5:t^y3> 

[0189] ^-^u-^-r >^>;*^A£Z)$^£: 

[0190] ( 2 ) ±13 ( 1 ) CD^fgT-^^^tlfe^IE 



( 

iI{I<3D-fe y is 3 >i:ot^, sf-^U— 7=->f >^y^rA 

SiJ&thZt&fU&tteho 
[0191] ttz. ±jfiUfe«t^C*«Wl:ff5*y h 
T 7-^ae<0E«-#J»SS«fc:<tnii, &<Z>J;?&*iJ,£ 

[0 19 2] (2) ^FIEaetWL-Ttt. tf^U— r--Y 
[0 19 3] ±E*»Wt»5*'J' h 9-^51 

Bfc D rJ f g 13® fcKf* £ £ ft « x n>t:^-^^gs^ii* 

-t± £ C <h £ >*-^l/ — T^-f V^y^rA^/D h =* 
* * ^ ©ffiSMSB^ ASffl «tS £ ffl ^ 5 - i: # pj 

XZ, Mffitt^-^IKWtfnJigfc&S. 

[ias©ffi^.^ifi0^] 

[Ell] #D5BI3©*y h7 — #^mMtirJ3&&Mm2ti 

[0 2] h^-^IEIBWS'^Ai:** b?-^ 

[Hi 3] *y hy-^^ZEWWv^^ACO^M©^^ 

[B4] ra*ffli©JB!BT-ffiffl1-a3>7-f 4^U-*>3> 
7 T ^ ;i/(Z) #l & 5* "T 8£0£ 0 T- h o 
[05] lil^ffioffJffitc^D h3;i/<DPSH<b©WISS$i0^ 

[0 6] HIIJfico^JBcDttf^ftBiMI-Sfcft^^D--? 1 

ho 
ho 

[09] ^iM^t-JllUt^^^tEIt^^c 
[010] |^iftffi<D^ffi£;fcttS*y hV-^^lEffitff 



iRpBB 2000-90031 
[011] HH«BC!)JBJBt*3Jt4*^ h^-^IEjlWf 
[012] |^ffiCDff288tc;fet*S*y h^-^JElMf 

[013] i^»iBo?B«-effiffl-r6«j6ff©«ift^-rBi 

[014] raSUE©JB«©iM^*KW1"Sfc«>©7D — 
[015] [g^©©JB©tt^*lftMt'Sfc»©7 0-- 

[016] m%Mmm<Dmw*mtthtz!sb(D7u-- 

[017] RHOK©JB«©tt^fcWW1-*t»©7D — 

[01 8] mnmmm<Dmft*m8?ztz&cDmT'$> 

ho 

[019] mnMvmmvi&tt&Mm^ i?*v#m& 

(DmftZI&WThtzisbcDmx$) ^ (A) ttWJOJtKffi. 
(B) tt^-^JRIKttft&^l-o 
[02 0] |HlHSSCDff^tC*itS3lff^'l' * 

jb, (b) b^w ^-v ^^ttffisst. 
[021] mnm<Dj&m£.#ii&*y hy—fmmmw 

[02 2] |il||JE©®!S©iifSE4!Sffl©^P^7 5 >^ 

^momm^^ u^oi^t, (b) iit^^^iie^ 

[02 3] fflmte<DM1£<OMim^4 i?*v#m<D7v#' 

[024] mmmmm.X'^m^tz^M^Tjk'tmmx' 

$> ho 

[02 5] |^||ffi©ffJ!ST^SU&je*S^riftMia"C- 

$> ho 

[02 6] |^||ffi©^ffiT-^Sbfcfl!l©«SSS^^iftB^ 
0T-fe^o 

[02 7] *y h9-^ : fIE»W>'^7 1 ACDfte(7)^JE^ 

^^^■r^D ^^0T-fe^>o 

[02 9] *v h 9-^ ^TE^Wv-^^ A<D $ £>lZi1tL<D 
[03 0] lilllliECDJBSgtcistta*^ h9-^^IEMW 

[031] raiiies©®!iit*Mt*a««i^o0»s*"r3i 

0/10T-fe^o 

[03 2] [5]*5Sco^^i5(tS3iffi!j{toa^)®ff^ 

>r y$<D-mm$i*7nirm.wmx&ho 

[03 3] [5]^©Jf^^^(tSiiff«J^©a^iifS^ 



(18) 
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[H34] raflhcDl^MiCD^JBtfeltS^l/— ^-r 
[1213 5] R|flbCDia6CDJK«t*5W-S*^l/— T'-f 

[03 6] fflm<DM1fa<DMBfc#VZ*'*i'--T4>ir 

[03 7] |^flb©llffiC0ffJffit*lt5*^U— t 1 ^ 

[039] ^*©ftat^wt^s©Sffiu/^;i/©«jE£Wi 

[W^©lftW] 



1 LAN 

3 a«is*yh9^ 

7 ^S^7h7-^ 

5 0 * y h 7-^IE#?#r>;*5 1 A 

5 5 ^-^iRISS 

5 6 ^-*f£j&95 

5 7 ^-^KPWSB 

vi jr^is—^^yyi/^^ a ^ 

V2 jx— If^RS 

v i i T-#wm/mmmm%t 

V 1 2 7>:J-7>f ifgSSB 

V 1 3 7*n brui/JESSB 

V2 1 7^'J^>3 >T^-f If 

v l o l h =3;u^^ y ^ 

V 2 0 1 *y hU — £T7 ] )>r— i/B > 



[01] 



[02] 
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tmn 
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[03] 



[07] 



51 



PT 




'PTa 



«W*£*CDC 



[14] 



I tcWt*—? I 1 I ao 

I 



a cracker. 



S21— 



✓ 50 



T 



94b 

I^JgnW-^ - H I aai| 



S22— 



I 



94<i 



][ 



a ell rac 



91b 92b 93b 

ftMD I i&ttjfcfD I mm\ \ ra 



Ste jfcijID | gHgjfejlD | »g3| [ rac \~ 94a^ 



I I ■ ^ ! 

| gfaftlD | j&fa^IP | W-S4 j ker, 94c 



90b 
90c 



500 



I Filter for login Analyzer # 
filterset ( 

physical = { ether: -* <-> as :bo :cc :xx :yy : ez I 

network = { ip: * <-> 202.26.95.63 ) 

transport » { tcp: * <-> 23 } 

analyzer = ( lo<jin-A login, conf -log lagin-log -dump login, dumpl 

} 
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91d J 92d JVte J 
91c 92c 93c 



[Ell 7] 



VI2a 



i 



I 



P5I 



P52 



P53 



MCN A 
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Server Address 
Client Address 
D«fhoet Name 
Lcqin Times 
Easy Password Used 



Cracking Data contents 

: Dec 26 13:28:00 1996 

: 202.26.55.68:23 

; 202.26.95.69:1024 

: hostl 

: Threshold Oser - 0 

: NO 



Threshold Syste 



Ccmnand Details 

Welcome to mail.nal.go.jp Ittyp4) 



login : 
root 

Pass wo rd : 
roots 
S : Login incorrect 
S : login: 
C : root 
3 ; Password; 
C : root 
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( a ) KmW&iS^J 77 l ) 
int fd,new..fd: 
f d-socket( ) : 

bind(fd.em^*<OT K t* * ^ - /u) ; 
whileOM 

new_ Id-accept (fd) : 

if(fork<) == 0){ 
closet fd); 

ne»_fd£f!i!->T-^- 9 < T v K*Vjr — £ iffifa Sr Artfrr 

) 

close(nef_fd); 

) 



<b) Se^^fs^Yr^U (-^-/<coig^) 
int fd,ne»_fd; 
fd=socket( ) ; 

bihd{fd.^sE1-6^- h); 
»hile(l)l 

ne^.fd^acccpttfd); 

if(fork() - 0){ 
closet fd): 

nev.fdSrRl'oT^'f 7> h fin 

I 

close(r>et_rd): 
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struct caL.fi Iter { 
char dir; 



}; 



/* direction */ 



/* datalink layer 

/* 

char dlk_id; 
union { 

struct ether filter 

} dlk.f; 



ether ; 



/* network layer 

/* — 

char net_id; 
union { 

struct ip_filter 
struct arp_f liter 

} net_f; 



ip; 
arp; 



/* transport layer 

/* 

char tra_id; 
union { 

struct tcp,filter 
struct udp_f liter 

} tra_f; 



tcp; 
udp; 



struct ca_endpoint { 
queue_t* 
short 

struct ca_filter 

struct ca_filter 

int 

int 

int 

struct ca_endpoint* 
struct ca eopt 

h 



-V 
V 



qptr; /* points to AA */ 

stat; /* status */ 

filter; /+ filtering rule */ 

nf_filter; /* no-forward filtering rule */ 

id; /* identifier */ 

fd; ' /* file descriptor */ 

bufcid; 

ca_e; /* used in accept */ 

opt; ft option */ 
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int fd,ne* Jd: 
fd=sacket() : 

bind(fd,£&#$t7)7 h*L-xvt— 
wMleOU 

ne*_fd=accept(fd); 
if(fork() 0){ 
ctose(fd): 
hi jack(neii_fd) : 
»hile(l)l 

nei.fdfcfcfe-iT-**— v >f T > h G>-r- ? &<S*l#tfr-t 4 
»rite<ne»_fd.i£{*T*T=-# .igfsJfc); 

] 

) 

clos€(nev_fd) : 
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STAfl! 



ETHEA: 00:60: »T:88:8d:ca.» O0:a0:24:32:16:0d 
IP: 202.26.75.116 » 202.26.75.71 
TCP: 4060B » 23 

( arc « (OST) 1< Id: 4553 Men: 71 > Kin Aug 31 09:58:13 1996 
BSDI BSD/OS 3.0 (rwtlog.nal.go. >p) (ttypO)... 



. login: 





(SRC) » dst )<id:45S3)<1en:1Q> *« Aug 31 09:56:13 199B 

src c< (OST) ](fd:4553}<len:Q> Hon Aug 31 09:56:1* »99fl 

(SRC) » dst ]rid:4553)<len:t> Hon Aug 31 09:58:18 1998 

src « (DS1> ]<id:4S53)<l«:1> Her Aug 31 09:58:18 1906 

(SRC) » dst )(itf:45531<lwi:Q» Han Aug 31 09:56:18 1938 

<SRC) » <fct ](id:4553)<lcn:l> Hon Aug 31 09:58:22 1998 

src « {0S7) |(id:45S3)<len:1> Km Aug 31 09:58:2? 1998 

(SRC) » dst )(id:4553)<1en:0> Hon Aug 31 09:58:23 1996 

(SRC) » dst )(id:4GS3)<)en:1> Hon Aug 31 09:58:73 1998 

ire « (OST) ]( id:45S3)<Un; (> ton Aug 31 09:58:73 1398 

(SRC) » dst J( id: 4553X1 en;0> Hon Aug 31 09:58:73 1996 

(SRC) » dst )(id:4E53)<lan:l> Hon Aug 31 09:58:24 1996 

src « (DST) )(id:4553)<1en:IO> Hrn Aug 3t 09:58:24 1998 

(SRC) » dst ){id:4553)<len:IO> Hon Aug 31 08:55:24 I9S8 

src << (DST) ](icJ:4553)c1efi:<> Hon Aug 31 09:58:24 1996 
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( (SRC) » dal |<id:4553)<l*i:0> fen Aug 31 09:56:24 1993 

f src « (OST) l(id:4553)(lon 12> K>« Aug 31 08:58:24 1998 
.. .Password: 

( (SRC) » dst )(id:45b3)<1«n:3> Hon Aug 31 09:58:24 1998 

£ src « (OST) ]{id:«5S3)<Tan:Q> Moo *ug 31 09:58:24 T998 

( (SRC) » dst J(id:4S53)<lsn;T> Hon Aug 31 09:56:32 1999 
rootOI 

[ src « (OST) )(id:4553)<len:?> Hm Aug 31 09:56:32 1998 



[ (SRC) » dst J(td:4S53)<1en:0> Hon Aug 31 09:58:32 1996 
| src « (OST) J(id:4553)<len:3l) Hon Aug 31 09:58:32 1998 
..Login incorrect. 

login: 

r (SEC) » dst ](trf:4553)<l«n:7> Hon Aug 31 09:58:3? 1898 

( src « (OST) |(ld: 4553) <len:0> Km Aug 31 09:53:32 1993 

£ <SHC) >> dst J<id:4S53)<l9n:1> Man Aug 31 00:56:37 19S6 

C src « (D5T) ]<id:4563)<lan:4> Hen Aug 31 09:56:37 19SB 

[ src « (DST) )<id:4S53)<1ffi:ia> Hon Aug 31 09:58:37 1998 
[ (SRC) » dst ]<id:4663)<l«:0> Hon Aug 31 09:58:37 1998 
[ (SRC) >» dst I<id:45S3)<l«i:Q> Hon Aug 31 09:56:37 1098 
[ src « (OST) |(id:4553)<1on:0> Han Aug 3 1 09:58:37 1998 
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